1. Field
The disclosed subject matter relates generally to computer security and, more particularly, methods of and systems for detecting spoofing of system information of remotely located client devices.
2. Description of the Related Art
The ubiquity of the Internet and the World Wide Web is reaching into nearly every aspect of people's lives, including those in which privacy and security are paramount. As more and more people use the Internet to conduct banking and to purchase goods, services, and licenses, it has become more and more crucial to guard against false authentication of people transacting via the Internet. Unscrupulous users may attempt to engage in fraudulent on-line business transactions under a false identity, while the more insidious users will attempt to spoof, or mask their identity or the origin of their transactions, by manipulating data or code resident in their computer or transmitted in an outbound message.
In addition, the social, communal nature to which the Internet has evolved requires some policing. Known malicious users are often banned from on-line services. For example, users who post unsolicited advertisements (spam) repeatedly in on-line forums often find themselves banned. Similarly, on-line multi-user computer games often ban “griefers”, users who show bad sportsmanship and whose intent appears to be spoiling the gaming experience of other users rather than competing in the proper spirit of the game. These malicious users often try to falsify authentication merely to attempt to appear to be anyone but themselves, rather than trying to appear to be another, specific person.
One approach to prevent false user authentication is to authenticate the client device, such as a personal computer or smart phone, through which a person is authenticated. Such ensures that the person's personal authentication data has not been stolen and used on a different client device. In addition, such device authentication allows device-specific bans, preventing a malicious user from concocting a new identity. One method of authenticating the device is to collect specific information about the device and to combine the information into a digital fingerprint.
In many on-line services, thin clients (e.g., content displayed in a conventional web browser from the server) are often preferable to thick clients (e.g., software installed in the client device). There are a number of reasons for this preference, such as greater user convenience as software installation is not required and the ability to maintain the software—including bug fixes and feature enhancements—at the server in just one location rather than supporting many different versions of the thick client installed in thousands or even millions of client devices.
However, thin clients do not have access to the sort of information included in a client device's digital fingerprint. Due to security concerns, web browsers are designed to limit thin clients' access to just a small portion of the content and hardware of the client device. For example, granting a thin client access to an entire hard drive or other persistent storage device would allow a malicious code to scan the hard drive for passwords and other sensitive information or to destroy information stored on the hard drive. Due to concerns regarding the security risks to the client device, thin clients are simply not permitted to gather enough information from the client device to robustly authenticate it. Generally speaking, any information of the client device to which a thin client would have access could be spoofed.
By spoofing such information about the client device, a malicious user of a client device can masquerade as another user or at least as someone other than herself. What is needed is a way to detect spoofing (i.e., falsification) of system information of the client device.